AZL-111002: CVE-2026-114605 affecting package python-dns 2.1.0-1

Q: Which applications are exposed to this issue?

Applications using dnspython to process untrusted DNS wire-format messages are exposed. The impact occurs during DNS name decompression when processing malicious compression pointer chains.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to provide a malicious DNS wire-format message containing compression pointers arranged to cause excessive traversal. No other prerequisites are specified in the available information.

Q: Is a fix available?

Yes. The issue is fixed in dnspython version 2.9.0; versions prior to 2.9.0 are affected.

Published Oct 22, 2026

Updated

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

Affected Software

1 affected component

azure-linux/python-dns<=2.1.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python-dns to a version that resolves this vulnerability.
Fixed in 2.9.0

Event History

Oct 22, 2026

Advisory Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114605

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using dnspython to process untrusted DNS wire-format messages are exposed. The impact occurs during DNS name decompression when processing malicious compression pointer chains.

What does an attacker need to exploit the vulnerability?

An attacker needs to provide a malicious DNS wire-format message containing compression pointers arranged to cause excessive traversal. No other prerequisites are specified in the available information.

Is a fix available?

Yes. The issue is fixed in dnspython version 2.9.0; versions prior to 2.9.0 are affected.

AZL-111002: CVE-2026-114605 affecting package python-dns 2.1.0-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a fix available?